Session Management Flaw in Postiz Affects User Tokens
CVE-2026-115933

9.9CRITICAL

Key Information:

Vendor

Gitroomhq

Status
Postiz-app
Vendor
CVE Published:
24 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-115933?

This vulnerability in Postiz arises from the application signing session, invitation, and password reset tokens with a shared secret, without any indication of the token's purpose. An attacker could exploit this weakness by obtaining a validly signed token, which could grant unauthorized access to sessions, invitations with customized roles, password resets, or even enterprise provisioning tokens. Additionally, a separate route for creating team invitations also displays similar signing vulnerabilities, potentially leading to further security breaches.

Affected Version(s)

postiz-app 2.15.0 < 2.25.3

References

https://github.com/gitroomhq/postiz-app
product
https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3
release-notes
https://github.com/gitroomhq/postiz-app/commit/a5affe62c7...
patch

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic, PBC
Enno Gelhaus
Nevo David
.